raw: ffffea0006c9ada0 ffff8801dae2fe58 0000000000000000 0000000000000000 __kernfs_new_node+0x1a3/0x580 fs/kernfs/dir.c:640 page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0) ------------[ cut here ]------------ kernel BUG at include/linux/mm.h:492! invalid opcode: 0000 [#1] SMP KASAN Dumping ftrace buffer: kernfs_new_node+0x80/0xf0 fs/kernfs/dir.c:679 (ftrace buffer empty) __kernfs_create_file+0x4d/0x330 fs/kernfs/file.c:989 Modules linked in: sysfs_add_file_mode_ns+0x21a/0x560 fs/sysfs/file.c:305 sysfs_add_file+0x4e/0x60 fs/sysfs/file.c:318 CPU: 0 PID: 29518 Comm: syz-executor5 Not tainted 4.17.0-rc6+ #73 sysfs_merge_group+0xfa/0x230 fs/sysfs/group.c:293 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 dpm_sysfs_add+0x161/0x210 drivers/base/power/sysfs.c:656 RIP: 0010:put_page_testzero include/linux/mm.h:492 [inline] RIP: 0010:put_page include/linux/mm.h:873 [inline] RIP: 0010:__skb_frag_unref include/linux/skbuff.h:2761 [inline] RIP: 0010:skb_release_data+0x6a9/0x860 net/core/skbuff.c:564 device_add+0xa11/0x16d0 drivers/base/core.c:1819 RSP: 0018:ffff8801b2296b60 EFLAGS: 00010206 RAX: 0000000000000000 RBX: ffffea0006af34dc RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff81a65345 RDI: ffffed0036452d60 device_create_groups_vargs+0x1ff/0x270 drivers/base/core.c:2439 RBP: ffff8801b2296c80 R08: ffff8801936b62c0 R09: 0000000000000006 R10: ffff8801936b62c0 R11: 0000000000000000 R12: dffffc0000000000 device_create_vargs drivers/base/core.c:2479 [inline] device_create+0xd3/0x100 drivers/base/core.c:2515 R13: ffffea0006af34c0 R14: ffff8801b8dbd9b0 R15: 0000000000000000 FS: 00007fad89bf3700(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffff600400 CR3: 000000019945d000 CR4: 00000000001406f0 mac80211_hwsim_new_radio+0x3c6/0x33b0 drivers/net/wireless/mac80211_hwsim.c:2560 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: skb_release_all+0x4a/0x60 net/core/skbuff.c:627 __kfree_skb+0x15/0x20 net/core/skbuff.c:641 sk_wmem_free_skb include/net/sock.h:1430 [inline] tcp_write_queue_purge+0x2b9/0x8a0 net/ipv4/tcp.c:2525 tcp_disconnect+0x3f5/0x1480 net/ipv4/tcp.c:2563 hwsim_new_radio_nl+0x7b8/0xa60 drivers/net/wireless/mac80211_hwsim.c:3247 genl_family_rcv_msg+0x889/0x1120 net/netlink/genetlink.c:599 tcp_close+0x100d/0x12b0 net/ipv4/tcp.c:2361 genl_rcv_msg+0xc6/0x170 net/netlink/genetlink.c:624 netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2448 tls_sk_proto_close+0x6d1/0xa70 net/tls/tls_main.c:303 genl_rcv+0x28/0x40 net/netlink/genetlink.c:635 netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline] netlink_unicast+0x58b/0x740 net/netlink/af_netlink.c:1336 inet_release+0x104/0x1f0 net/ipv4/af_inet.c:427 netlink_sendmsg+0x9f0/0xfa0 net/netlink/af_netlink.c:1901 inet6_release+0x50/0x70 net/ipv6/af_inet6.c:459 sock_release+0x96/0x1b0 net/socket.c:594 sock_close+0x16/0x20 net/socket.c:1149 sock_sendmsg_nosec net/socket.c:629 [inline] sock_sendmsg+0xd5/0x120 net/socket.c:639 __fput+0x34d/0x890 fs/file_table.c:209 ___sys_sendmsg+0x805/0x940 net/socket.c:2117 ____fput+0x15/0x20 fs/file_table.c:243 task_work_run+0x1e4/0x290 kernel/task_work.c:113 exit_task_work include/linux/task_work.h:22 [inline] do_exit+0x1aee/0x2730 kernel/exit.c:865 __sys_sendmsg+0x115/0x270 net/socket.c:2155 __do_sys_sendmsg net/socket.c:2164 [inline] __se_sys_sendmsg net/socket.c:2162 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2162 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x455a09 RSP: 002b:00007f999b5ebc68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f999b5ec6d4 RCX: 0000000000455a09 RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000013 RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000014 R13: 00000000000005ce R14: 00000000006fdbf0 R15: 000000000000001b ieee80211 phy45: Selected rate control algorithm 'minstrel_ht' do_group_exit+0x16f/0x430 kernel/exit.c:968 get_signal+0x886/0x1960 kernel/signal.c:2482 do_signal+0x98/0x2040 arch/x86/kernel/signal.c:810 exit_to_usermode_loop+0x28a/0x310 arch/x86/entry/common.c:162 prepare_exit_to_usermode arch/x86/entry/common.c:196 [inline] syscall_return_slowpath arch/x86/entry/common.c:265 [inline] do_syscall_64+0x6ac/0x800 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x455a09 RSP: 002b:00007fad89bf2c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: 0000000000004000 RBX: 00007fad89bf36d4 RCX: 0000000000455a09 RDX: 00000000fffffdef RSI: 00000000200005c0 RDI: 0000000000000014 RBP: 000000000072bea0 R08: 0000000020000000 R09: 000000000000001c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000015 R13: 00000000000005d8 R14: 00000000006fdce0 R15: 0000000000000000 Code: d7 e8 0c 17 9f fb 48 8b bd 10 ff ff ff e8 00 e7 fe ff e9 22 fb ff ff e8 f6 16 9f fb 48 c7 c6 60 75 4b 88 4c 89 ef e8 c7 1c cc fb <0f> 0b e8 e0 16 9f fb 4c 8d 6b ff e9 b0 fc ff ff e8 d2 16 9f fb RIP: put_page_testzero include/linux/mm.h:492 [inline] RSP: ffff8801b2296b60 RIP: put_page include/linux/mm.h:873 [inline] RSP: ffff8801b2296b60 RIP: __skb_frag_unref include/linux/skbuff.h:2761 [inline] RSP: ffff8801b2296b60 RIP: skb_release_data+0x6a9/0x860 net/core/skbuff.c:564 RSP: ffff8801b2296b60 ---[ end trace e6e382b2d134e5ab ]---